Search for vulnerabilities
Vulnerability ID | VCID-4qty-568y-aaas |
Aliases |
CVE-2015-6660
|
Summary | The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to conduct CSRF attacks that upload files in a different user's account via vectors related to "file upload value callbacks." |
Status | Published |
Exploitability | 0.5 |
Weighted Severity | 6.2 |
Risk | 3.1 |
Affected and Fixed Packages | Package Details |
Exploitability (E) | Access Vector (AV) | Access Complexity (AC) | Authentication (Au) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
---|---|---|---|---|---|---|
high functional unproven proof_of_concept not_defined |
local adjacent_network network |
high medium low |
multiple single none |
none partial complete |
none partial complete |
none partial complete |
Percentile | 0.71743 |
EPSS Score | 0.00335 |
Published At | Nov. 1, 2024, midnight |
Date | Actor | Action | Source | VulnerableCode Version |
---|---|---|---|---|
There are no relevant records. |